Investigating failures of riser emergency shutdown valves
Article published in the Regulator | Issue 1: 2016
Riser emergency shut down valves (RESDVs) are safety-critical components at the extremities of hydrocarbon pipelines. Should there be a loss of containment from hydrocarbon pipework on the facility, RESDVs are designed to close to prevent the contents of interconnecting pipelines from feeding any fire or developing a gas cloud that could lead to an explosion at the facility.
In Issue 3 (2015) of the Regulator, NOPSEMA published an Emergency shut-down and blow-down valve integrity management article highlighting deficiencies in the implementation of functional assurance plans for emergency shut-down and blowdown systems and failures to meet relevant performance standards. The UK regulator, the Health and Safety Executive (HSE), recently published a research report entitled Investigations into the immediate and underlying causes of failures of offshore riser emergency shutdown valves (RR1072) providing further information for consideration by Australian operators.
The HSE’s report provides an analysis of information collected from an operator survey on 179 reported failures of RESDVs in the past seven years from the UK Continental Shelf (UKCS). Operators frequently state that the probability of failure of RESDVs is 1 in 1000 or lower. Given there are less than 500 RESDVs in the UKCS, there may be a mismatch between expected and actual performance. This article explores this mismatch and what Australian operators can do to ensure RESDVs are fully functional when required in an emergency.
The failure of RESDVs can be identified from inspection, maintenance and testing or from actual demand while in service. Operators are reminded that the failure of RESDVs is considered damage to safety-critical equipment. Under Clause 82 of Schedule 3 to the Offshore Petroleum and Greenhouse Gas Storage Act 2006, and in accordance with NOPSEMA guidance, operators are required to notify and report damage to safety-critical equipment to NOPSEMA. The HSE’s report identified the age of the RESDVs that failed and the failure to learn and implement lessons from previous incidents as prevailing themes. Operators indicated corrosion, the age of the RESDV and seizure/sticking as the three most common immediate causes for failure. Nearly half of all failed RESDVs had previously failed, and over a quarter of failed RESDVs were brought back into service after cycling and/or lubricating the valves. The report concludes operators need to perform a root cause analysis and identify improvements in inspection, testing and maintenance regimes rather than simply fixing the RESDV and returning it to service.
The inspection, testing and maintenance regime for a new RESDV is likely to be different from that required for a 25 year old RESDV. Obtaining vendor guidance on inspection, maintenance and service life for the individual components from different manufacturers that comprise an RESDV installed over a quarter of a century ago is likely to be a challenging task for operators. As such, operators need to put considerable thought into their inspection, testing and maintenance regimes.
Lessons learned from previous RESDV failures from Australia and the UK indicate that ageing equipment will suffer from:
• Degradation of polymeric materials, such as valve seals, shuttle valve o-rings and housing weather seals. Deteriorated o-rings result in degradation of shuttle valve performance and eventual seizure, and deteriorated weather seals will lead to water ingress and accelerated corrosion product build up within the actuator, reducing operability.
• Corrosion of metallic components, such as actuator housings and internal components, return springs, vent port valves and plugs, spring canisters, retention grooves and circlips and tie rods. Corroded return springs become weaker over time and have been known to collapse completely. Such a failure leaves the RESDV in a ‘failed open’ state, and will remain undetected until the next attempt to operate. Corroded spring canisters and tie rods have led to energetic spring ejection, with potential for serious escalation should small bore process pipework be damaged or serious injury to personnel in the vicinity of the projectile.
• Degradation of grease and lubricants leading to seizure or increased friction with insufficient actuator motive force to close the valve in a timely fashion, or complete seizure resulting in the valve failing to danger.
• Leaks of product, hydraulic fluid or process air
• Contamination of process air or hydraulic fluid leading to internal corrosion of actuator pipework or pistons.
• Corrosion of solenoid contact surfaces, causing them to stick, resulting in undetected fail to danger. To reduce the number of RESDV failures, operators should ensure that:
• Inspection, testing and maintenance regimes are employed with due consideration of anticipated valve and actuator failure modes, appropriate to the age and condition of the RESDVs. This should include consideration of whether periodic replacement of components or partial/full strip down maintenance is required. This might require the components to be removed from service and brought ashore to manufacturer or workshop facilities for refurbishment. Failure Modes, Effects and Criticality Analysis (FMECA) may be an appropriate methodology to enable identification of the causes of component failure and development of appropriate mitigations for RESDVs.
• Root cause analysis of previous failures is performed and findings are used to enhance inspection, testing and maintenance regimes. Application of the FMECA methodology may also be of benefit in failure investigations.
• Trending and analysis of RESDV performance data to anticipate failures, recording measurable quantities such as closure time and internal leakage rate rather than just pass or fail. There should be recognition that some failure modes (such as solenoid sticking) may lead to undetectable instantaneous fail to danger rather than gradual deterioration.
In accordance with Clause 9(2)(e) of Schedule 3 to the OPGGS Act, NOPSEMA reminds operators to take all reasonably practicable steps to implement and maintain appropriate procedures and equipment for the control of and response to emergencies at the facility. The successful closure of an RESDV in an emergency depends on the operation of an interlinked series of components all of which must function effectively. Operators should review the adequacy of their RESDV inspection, testing and maintenance regimes with the above issues in mind and draw on available industry guidance such as that within BSI Standards Publication PD 8010:5-2013 Subsea Pipelines – Guide to Operational Practice.